CLEAN COPY 




[ENDED PAGE 




SYSTEM AND METHOD FOR MEASURING THE TRANSFER 



DURATIONS AND LOSS RATES IN HIGH VOLUME 



TELECOMMUNICATION NETWORKS 



BACKGROUND OF THE INVENTION 



The present invention relates to a non-intrusive 
method for measuring the loss rates and transfer durations 
for data in a telecommunication network in packet mode. 

The invention is particularly adapted to high volume 
networks that are operated in non-connected mode. It 
relates also to a distributed architecture system 
comprising a plurality of flow observation probes arranged 
in several points in the network, and means for 
transmitting these measurements to a collecting module 
which is connected to storage means and means for analyzing 
the measurements that have been provided. 

Packet mode telecommunication networks are 
characterized in that transmitted information are conveyed 
in groups referred to as packets, that are substantially 
made up of one header which contains information for 
sending a packet through the network as well as data to be 
transmitted. Such packets are conveyed through the 
network, and travel, in accordance to what suits the best 
the latter, through the most diversified transmitting and 
switching means. 

An exemplary packet mode network is the Internet 
network which is operated with IP protocol (Internet 
Protocol) . As a few examples of transmitting and switching 
means related to the IP protocol, ISDN (integrated services 
digital network), FR (Frame Relay), ATM (Asynchronous 
Transfer Mode) , SDH (Synchronous Digital Hierarchy) , SONET 
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(Synchronous Optical network) , DWDM (Dense Wavelength 
Digital Multiplexing) networks, etc., can be found* 
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close with one another. 

The present invention aims to alleviate the above- 
mentioned drawbacks. 



SUMMARY OF THE INVENTION 
To this end, one object of the invention is to provide 
a method and a system with a distributed architecture that 
allow to measure accurately the transfer durations and loss 
rates for telecommunication networks in packet mode. The 
method comprises the steps for performing the measurement 
operations by a plurality of observing probes that are 
synchronized and distributed at different points in the 
network, on data packets which are transmitted through the 
network, the measurement operations comprising the dating 
and the identification of the. data packets, the measurement 
results being transmitted from the probes to the collecting 
module . 

The method according to the invention is characterized 
in that the measurement operations further comprise a 
classification of the data packets in a homogenous flow, 
and a counting of the packets in the flow, the measurement 
results being transmitted from the probes to the collecting 
module through the network (1), the collecting module 
performing a correlation between all of the measurement 
results received from the probes, including the 
determination of the unidirectional transfer durations per 
flow or information flow group, and of the loss rate for 
the packets. 

The method according to the invention is advantageous 
in that it does not require the use of test packets, which 
permits the achievement of a very wide representativeness 
of every measurement. It is also advantageous in that a 
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large number of measurements can be carried out, resulting 
in a high degree of statistical accuracy. Finally, the 
number of measurements being carried out can be modulated 
in 
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in one flow, the transmitting means of the probes using the 
network to transmit the measurements carried out to the 
collecting module, the collecting module comprising means 
for determining the unidirectional transfer durations per 
flow or information flow group and the loss rate for the 
packets . 

BRIEF DESCRIPTION OF THE DRAWINGS 
Other characteristics and advantages of the invention 
will be more fully understood from the following 
description to be considered as a non-limitative example 
while referring to the appended drawings, in which: 

Figure 1 shows schematically an exemplary embodiment 
of the invention in a telecommunication network in packet 
mode; 

Figure 2 shows a functional diagram of a system 
implementing a method according to the invention; 

Figure 3 depicts schematically an example of an 
internal function organization for a system according to 
the invention; 

Figure 4 shows a functional diagram depicting the 
operation of an observing probe used in a system according 
to the invention; 

Figure 5 shows a functional diagram depicting the 
operation of a collecting module used in a system according 
to the invention; and 

Figure 6 to 15 depict schematically the operation of a 
system according to the invention. 



DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT (S) 
In Fig. 1, there is shown schematically a high volume 
network 1 that is operated in non-connected mode, such as a 
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network based on IP protocol (Internet Protocol) . A 
plurality of flow-observing probes 2i are arranged at 
different points in the network for carrying out 
measurements on flows of data that are exchanged through 
this network. Means for compressing 
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each packet they have access to. These measurements 
consist in performing dating, classification and 
identification of the packets, as well as compressing these 
measurements. Every probe 2i transmits, through the network 
1, the compressed measurements to the collecting module 4 
that correlates all of these measurements. 

Other embodiments are also possible in the scope of 
the invention, notably in the following cases: 

- the users 8i are not necessarily end users for information 
being conveyed within the packets; for instance, they may 
represent local networks or other networks in packet mode; 

- the probes 2i can be connected to the collecting module 4 
through means other than the network 1; for instance, 
through another telecommunication network, or through a 
local storage medium that stores data from the collecting 
module 4, sending them back to it later on; 

- the same collecting module 4 can be connected to several 
collecting modules 4; 

- several collecting modules 4 can communicate to build up 
correlations between measurement elements they have. 

As an example, a possible functional diagram of the 
system according to the invention is shown in Fig. 3, Four 
functional groups can be found therein: 

- the rule group 10, with the rules being fixed statically 
or semi-statically (for example by the system operator) ; 

- the load evaluation group 20, measuring the load rate on 
the local central processing unit, the memory occupancy, 
etc * . . ; 

- the calculation group 30, evaluating dynamically the 
values relating to compaction, sampling, etc.,.; 
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- the data path group 40, producing records that contain 
combinations (class, date, signature) for each packet. 

When activated, the probes 2i gain a common time 
reference 31, The inaccuracy of this reference between two 
probes 2i affects directly the accuracy of the result for 
the whole device. Means for gaining that time reference 
can be diversified as well as multiple; as non-limitative 
examples, GPS (Global Positioning System) , broadcasting 
through radio waves, high stability drivers, NTP (Network 
Time Protocol) and SNTP (Simple Network Time Protocol) 
protocols may be mentioned; 

- each packet is subjected to dating 41 using the absolute 
time reference when it is observed by a probe 2i. The 
latter is able to date, either the start of the packet, o 
the end of the packet, or any other criterion. 

- each packet is subjected to the calculation of the 
signature 42, that is for representing it later on. The 
signature enables to reduce the amount of information 
which is needed to identify the packet. That signature 
results typically from a binary polynomial calculation 
(for instance, CRC calculation - cyclic redundancy check 
on 16 or 32 bit elements) . The signature calculation is 
performed either on the whole packet or on a part of it, 
in accordance to what is contemplated in relation with th 
structure and the variability of the contents of the 
packets in the network. The signature has to be small 
compared to the mean pocket size, so as to ease its 
storage, its transmission and its subsequent processing. 
It must be capable of assuming different values to make 
negligible the likelihood that two different packets have 
the same signature. As an example, it 
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can be considered that one signature on 16 bit elements 
enables to identify about 256 different packets with a low 
likelihood of ambiguity; 

- each packet is subjected to a classification operation 44. 
Criteria for classification are typically those that are 
conventionally retained to identify flows between networks 
and sub-networks (such as IP network sub-addresses), flows 
between end equipment (such as IP addresses), flows 
between applications (such as IP addresses and UDP/TCP 
transport addresses), etc... Each packet is then 
identified by combining all or part of the elements : 
class, date, signature; 

- each class can be subjected to filtering 45; i.e., the 
probes 2± do not store the combinations (class, date, 
signature) for packets belonging to one of the classes for 
which the filter has been provided; 

- each class can be subjected to a compaction or a semi- 
static sampling operation 46. In this case, only a part 
of the combinations (class, date, signature) for packets 
belonging to a given class will be retained. The sampling 
rate depends typically of the class, and will not 
theoretically change dynamically. For instance, it may be 
desirable to keep all of the combinations of packets 
conveying voice, and only a part of those conveying 
computer files . 

- each class can be subjected to a dynamic sampling with a 
rate which depends of the congestion conditions in the 
system : measurement of the occupancy of buffers 21 and 
memories 22 of the probes 2 if transmission flow rates 
towards the collecting module 4, network load, load of the 
collecting module 4, etc... A multiplicity of criteria 
can be used so that the overall operation 
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can take place automatically in an area that suits the 
best the device administrator. For instance, the highest 
sampling rate for a given maximum flow rate of a flow 
brought back from the probe to the collector, or a minimum 
flow rate of a flow brought back to the collector for a 
given sampling rate; 
- a counter is associated with each combination (class, 
date, signature) that is retained, indicating the number 
of packets observed in the flow. The collecting module 4 
is then capable to measure the loss rate in the network by 
comparing between the counters associated with the same 
packets at different points in the network. 

The filtering and static and dynamic sampling 
operations allow to reduce the amount of combinations 
(class, date, signature) to be stored and processed. The 
provision or removal of filters, the values of the semi- 
static sampling rates, the parameterization the dynamic 
sampling, etc..., can be achieved, for instance, through an 
administrative operation performed from one of the 
collecting modules 4 or operating modules 7. 

Sampling criteria can be diversified. As examples, 
periodical sampling which consists in keeping one 
combination every N combinations, statistical sampling that 
depends on drawing a random variable of which statistical 
characteristics are under control, and sampling on 
signature that consists in keeping only those combinations 
of which the signatures belong to a given set of values can 
be mentioned. 

The sequence order through which a probe 2i performs 
the above-mentioned operations may change. A probe 2i can 
classify the packets before dating them, as long as the 
measurement accuracy is not altered to a great extent. In 
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the same way, the filtering operations can be performed at 
different instants during the process. 
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Fig. 5 depicts the steps for collecting and 
correlating the measurements by a collecting module 4. 

The latter receives samples of the non-filtered 
combinations (class, date, signature) originating from all 
of the observing probes 2i attached therewith; 

- each packet is theoretically seen by two observing probes 
2i : the first time when entering the network, the second 
time when leaving. However, other situations may occur. 
For instance, one packet might be seen only once if the 
supervision domain is not closed, or more than twice if 
there are observing probes 2i within the network; 

- each time a packet has been observed by an observing probe 
2i as passing by, one combination (class, date, signature) 
is received by the collecting module 4, except when 
filtering, sampling or loss of return message, etc..., is 
taking place; 

- the collecting module 4 correlates the combinations 
(class, date, signature) for the same packet, for instance 
by comparing between the signatures and by increasing the 
transit delays in the network; 

- in case of success, it infers from above, through a simple 
arithmetical calculation, on one hand, the transfer 
duration between the different observing probes 2i for the 
packet in question and on the other hand, the number of 
packets that were possibly lost in the network. Moreover, 
a number of packets in excess at the exit enables to 
indicate that a fault in one of the network devices or an 
intrusion attempt has occurred. More sophisticated 
calculations, such as mean, minimum, maximum, median, 
etc..., values for a given time slot and a certain flow 
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type, can also be achieved in the collecting module 
prior to the storage operation 
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It is to be noted that sampling do not reduce the 
counting accuracy. This is equally true when packets are 
lost, that otherwise would have cause tickets to be issued. 
Actually, the counter that is associated with every ticket 
produced yields the total number of packets since the last 
sampled ticket. The only consequence is a loss of accuracy 
as for the precise instant at which the loss occurred and 
the exact identity of the packet that was lost. Both 
characteristics are of little usefulness a priori, thus 
being not much looked after. However, as the sampling 
characteristics are attached to a certain flow, it is 
always possible not to sample the flows for which detailed 
information are desirable. For those flows, all of the 
packets will cause one ticket to be issued. Moreover, as 
the number of measurements is lower than the number of 
packets, statistical laws will be applicable, that are well 
known as for the validity and the accuracy of the 
measurements which are applied to the sample thus captured. 

Therefore, the method according to the invention 
enables to achieve flow control at the probe level in 
order : 

- to protect the collecting module 4 against an overload : 
(too many tickets to be processed relatively to its own 
resources that are the available processing power and the 
memory size, . . . ) ; 

- to protect the probes 2i against an overload : (too many 
tickets to be processed relatively to its own resources 
that are the available processing power and the memory 
size, . . .) } 

- to protect the network used to transmit ticket records 
from the probe to the collector; 
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- to adapt to changes in the capacity of the network used to 
transmit ticket records from the probes 2i to the 
collecting module 4; 
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- to enable an optimum distribution of the measurement 
resource between the different flows in case of 
congestion; 

- to optimize the pair (measurement accuracy/network load) 
in accordance with combined criteria, in normal operation. 

To control the flow, the following functions may by 
used, separately or in combination: 

- limitation of the overall flow through the network to a 
maximum value due to the transmission of ticket records 
from the probes 2± to the collecting module 4. That limit 
can, either be defined by an initial configuration, or be 
modulated by the collecting module 4 or by an external 
device operating the network; 

- limitation of the sampling rate to a maximum value. That 
limit can, either be defined by an initial configuration, 
or be provided by the collecting module 4 or by an 
external device operating the network. In addition, it 
may differ from each type of flow or flow group; 

- reduction of the sampling rate. That reduction can, 
either be defined locally by observing the congestion of 
the probes 2 if or be fixed by the collecting module 4 or 
by an external device operating the network. That 
reduction may differ for each type of flow or flow group. 
The reduction law must allow the collection module 4 to 
correlate records which were performed by probes 2i 2± 
having not the same sampling value for a given flow, the 
reduction being not necessarily synchronous between the 
probes 2 ± . A principle which must be retained is the 
inclusion one; tickets of the "reduced" flows having to be 
included also in the tickets of the "lesser reduced" 
flows. In this way, tickets of the probe 2i having the 
highest reduction factor 



